Last updated: 2 April 2026

1. Who We Are

MumReady ("we", "us", "our") operates the website mumready.com (the "Service"). We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: hello@mumready.com

2. The Basics (Quick Summary)

We believe in keeping things simple and transparent:

• We only collect the data we need to run MumReady
• We do not sell your personal data
• We do not collect health or medical information
• You control your data and can change or delete it anytime
• We only use optional analytics and marketing if you choose to opt in

3. What Data We Collect

3.1 Information You Provide

When you use MumReady, you may choose to provide:

Account information

• Email address
• Display name
• Avatar (optional)

Profile information (all optional)

• Life stage (e.g. planning, expecting, new parent)
• Due month (for planning purposes only)
• Region
• Job title or income range (if you choose to enter it)

These fields are optional — you decide what to share.

3.2 Your Activity in MumReady

We store the information needed to make the product work, such as:

• Baby name shortlists
• Budget planning entries
• Tool usage (e.g. planners, checklists)
• Preferences and saved items

This data is linked to your account so you can access it later.

3.3 Analytics Data (With Your Consent)

If you allow it, we collect limited information about how you use MumReady to improve the product. This includes:

• Pages you visit
• Features and tools you use
• General interactions (clicks, navigation)

This data:

• Uses a pseudonymous ID (not your name or email)
• Is not used to identify you personally
• Is kept for up to 90 days, then deleted or anonymised

3.4 Other Automatically Collected Data

• Device data: browser type, operating system, and screen size
• Cookies: essential cookies for authentication, plus optional analytics cookies set only with your consent (see our Cookie Policy)

3.5 Data We Never Collect

• National Insurance numbers or tax codes — these are typed into letter templates on your device and never stored on our servers
• Health or medical data — we do not process special category data under Article 9 of GDPR
• Payment card details — all payments are handled by our payment processor (Stripe), and we never see or store your card information

4. How We Use Your Data

PurposeLawful Basis (Art. 6 GDPR)Provide account features (shortlists, budgets, letters)Contract — necessary to deliver the ServiceSend transactional emails (password resets, account changes)ContractPseudonymous analytics to improve the ServiceConsent — only after you accept analytics cookiesMarketing emails (tips, feature updates, partner offers)Consent — granular opt-in per categoryFraud prevention and security monitoringLegitimate interestComply with legal obligationsLegal obligation

5. Data Minimisation

We follow the GDPR principle of data minimisation. We only collect data that is necessary for the specific purpose stated above. Profile fields are optional — you choose what to share. Analytics data is pseudonymous and cannot be linked back to your identity.

6. Data Sharing & Sub-processors

We never sell your personal data. We share data only with the following categories of processors, all under appropriate data processing agreements:

Sub-processorPurposeLocationSupabase (database & auth)Account management, data storageEU / US (SCCs in place)Stripe (payments)Subscription billingUS (SCCs in place)Vercel / Lovable (hosting)Website deliveryEU / US (SCCs in place)

We may also share data with legal authorities where required by law or to protect our rights.

7. International Transfers

Some of our sub-processors are based outside the UK/EEA. Where personal data is transferred internationally, we ensure appropriate safeguards under UK GDPR Article 46, including:

• Standard Contractual Clauses (SCCs) approved by the ICO
• Adequacy decisions where applicable
• Supplementary technical measures (encryption in transit and at rest)

8. Data Retention

Data TypeRetention PeriodAccount data & profileUntil you delete your accountUser-generated content (shortlists, budgets)Until you delete it or your accountPseudonymous analytics events90 days (auto-deleted)Marketing consent recordsDuration of account + 12 months (for audit)Feedback submissions24 months

9. Your Rights

Under UK GDPR, you have the following rights:

• Access (Art. 15) — request a copy of your personal data
• Rectification (Art. 16) — correct inaccurate data via your profile or by contacting us
• Erasure (Art. 17) — request deletion of your data ("right to be forgotten")
• Restriction (Art. 18) — request we limit processing of your data
• Data portability (Art. 20) — receive your data in a structured, machine-readable format
• Object (Art. 21) — object to processing based on legitimate interests
• Withdraw consent (Art. 7) — withdraw consent at any time without affecting prior processing
• Not be subject to automated decision-making (Art. 22) — we do not make automated decisions that produce legal or significant effects on you

To exercise any right, email hello@mumready.com. We will respond within one calendar month as required by UK GDPR. We may ask for identity verification before processing your request.

10. Cookie Consent

We use a cookie consent banner that allows you to accept or reject optional cookies before any non-essential tracking occurs. You can change your preference at any time by clearing your browser cookies and revisiting the site. For full details, see our Cookie Policy.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you (Art. 22 GDPR). Any AI-powered features (e.g. name suggestions) are informational only and do not affect your rights or access to the Service.

12. Special Category Data

We do not collect or process special category data as defined by Article 9 of GDPR. This includes health data, biometric data, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, and data concerning sex life or sexual orientation.

13. Children's Privacy

The Service is intended for users aged 16 and over, in line with the UK's age of digital consent. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

14. Security Measures

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Secure authentication with hashed passwords
• Row-level security ensuring users can only access their own data
• Regular security reviews and vulnerability scanning
• Principle of least privilege for all data access

15. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay, in accordance with Articles 33 and 34 of UK GDPR.

16. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email or in-app notification. We will also update the consent version, which will trigger a re-consent prompt via the cookie banner.

17. Contact & Complaints

For questions, data requests, or complaints about this policy, contact us at hello@mum-ready.com.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated.